Okwembulwa impendulo ye-STUN lapho i-VPN isebenza kurutha
Ikheli lomhubhe kaurutha akulona ikheli lendawo lesiphequluli. Landelela indlela isicelo ngasinye esihanjiswa futhi sihumushwa ngayo ngaphambi kokufunda okubikwa isibonisi.
Lapho umhubhe uhlala kurutha, umshini osebenzisa isiphequluli awunawo nhlobo uxhumano lomhubhe. Buza lowo mshini ngamakheli awo endawo futhi uthola ikheli le-LAN eliyimfihlo kanye nokuzungeza, akukho okufana nekheli le-VPN. Noma kunjalo, isiphakeli se-STUN ohlangothini olude sisengabika okuthile okunengqondo mayelana nomzila, futhi lokho elikubikayo kuncike ngokuphelele ekutheni leso sicelo sithunjiswe futhi sahunyushwa kanjani.
Lena yingxenye efanele ukuthi wehlise ijubane. „Isiphequluli asinalo ikheli le-VPN“ siphendula umbuzo mayelana nokuxhumana, kuyilapho ikheli elibonisiwe liyimpendulo mayelana nomzila odlula ekuhumusheni. Ukuhlanganisa kokubili kukhiqiza iziphetho eziqinisekile mayelana nokwembulwa okungasekelwa ubufakazi.
Amadivaysi amabili, amasethi amabili okuxhumana
Kusilungiselelo olusekelwe kurutha umhubhe uphela kurutha futhi iklayenti le-LAN lithumela ukuhamba okujwayelekile esangweni lalo elizenzakalelayo. Uhlu lokuxhumana lweklayenti luhlala lufushane: ikheli elilodwa eliyimfihlo, mhlawumbe elesibili lenye inethiwekhi, kanye nokuzungeza. Ingozi ayikho ekutheni elinye lawo libe yikheli lomhubhe ngengozi; ingozi ikukuthi isicelo siphuma ngomzila ongawukhethanga.
Buza iklayenti ukuthi iyiphi indlela indawo ethile ezoyithatha esikhundleni sokubuza ukuthi yikuphi ukuxhumana okukhona. Impendulo isho isango kanye nekheli lomthombo okwakuzosebenzisa i-kernel, futhi lokho sekuyisikhombisiwe ngaphezu kwanoma yiluphi uhlu lwamakheli.
ip route get 198.51.100.20
ip -6 route get 2001:db8::20
wg show wg0 allowed-ipsIzikhawu zemibhalo ziyizindawo ezinhle zokuhlola ngoba azikaze zixazululeke zibe isevisi yangempela. Qhathanisa lokho iklayenti elikushoyo nalokho urutha ekushoyo, futhi thatha noma yikuphi ukungezwani njengobufakazi bokuthi ukuthunyelwa kwemigomo, umthetho womhubhe ohlukanisiwe noma indlela yesibili ezemukelwe ngayo yenza okuthile ongakucabanganga.
Okungashiwo impendulo ye-Binding
RFC 8489 ichaza isicelo nempendulo ye-Binding, lapho isiphakeli sibika ikheli lokuthutha lomthombo elikubonile kuleso sicelo. Lesi yisitatimende mayelana nenhlanganisela eyodwa yesihlanu ngesikhathi esisodwa, hhayi ukubalwa kokuxhumana kweklayenti. Ngakho konke okuthakazelisayo kwenzeka phakathi kweklayenti nephuzu lokubheka.
Leyo gebe igcwaliswa ukuthunyelwa nokuhunyushwa. Urutha olwenza i-NAT yomthombo ekuhambeni okuphumayo lushintsha umthombo oyimfihlo weklayenti ngekheli lalo kuxhumano oluphumayo. Uma lowo xhumano kuwumhubhe, isibonisi sibona ikheli lomhubhe. Uma iphakethe likhishiwe emhubheni, isibonisi sibona lokho okwenziwe ukuhunyushwa kwe-WAN. Iklayenti elifanayo, isibonisi esifanayo, impendulo ehlukile.
Amacala amathathu abukeka afana futhi engafani
Umehluko owusizo awusiwona kamphakathi nokuyimfihlo, kodwa ukuthi yiluphi uphuzu lokusebenzisa olubhekene nephakethe. Sebenza amacala ngamathebula kaurutha uqobo evuliwe, ngoba isiphequluli esisodwa singakhiqiza womathathu kuye ngomthetho owukhohlwe ukuthi wawubhalile.
| Where the request leaves | What rewrites the source | What the reflector reports |
|---|---|---|
| Tunnel interface on the router | Router NAT towards the tunnel address | The tunnel address as seen on that path |
| WAN interface, excluded by policy | Ordinary WAN translation | The public WAN address |
| Private reflector reached through the tunnel route | Router NAT towards the tunnel address | An internal identifier valid only inside that path |
Icala lesibili kuphela elephula isidingo sokuthi ukuhamba okuthile kungaze kuphume ngqo, futhi iwona kuphela icala lokuqala nelesithathu embula isihlonzi esisohlangothini lomhubhe. Awekho kula mathewu amathathu ayisitatimende mayelana nokuziphatha komhlinzeki othile: ukuthi isibonisi esiyimfihlo singafinyeleleka noma cha kuncike ekuthunyelweni, kumakheli e-IP avunyelwe ohlangothini olunye kanye nomgomo womdwebo womlilo ezinhlangothini zombili.
Ukuba ne-akhawunti kumhlinzeki ofanayo akufakazi lutho kwalokhu. Kufanele futhi kukhunjulwe ukuthi isicelo esithunjiwe singagcina umthombo we-LAN weklayenti uma kungekho okusihumushayo, ngakho insimu yomthombo kufanele ilandelelwe hhayi ukucatshangwa kusukela kumdwebo wokwakheka.
Ukuqoqa akukona ukukhetha
I-WebRTC iqoqa amakheli angabambimeli ukuze kuzanywe, futhi umbambimeli ovela ohlwini lokuxilonga kungenzeka angakaze athwale imidiya. Ukufunda uhlu njengokuthi „yilokhu okufundwe uhlangothi olunye“ kwandisa ubufakazi ngokweqile. Ipheya ekhethiwe yiyo eyathwala isikhathi, futhi isensimini enye.
Isihloli sokuphuma se-HTTPS siphendula omunye umbuzo: ikheli lomthombo elesiphakeli sewebhu elikubonile kuleso sicelo. Lona ukuhlola okuphambene okuwusizo ngoba lisebenzisa iphrothokholi ehlukile futhi ngokuvamile indawo ehlukile kunesibonisi se-UDP, futhi ukungezwani phakathi kwalokhu kokubili ngokuvamile kukhombisa umthetho wokuthunyelwa hhayi iphutha.
Nquma umgomo, bese ufunda impendulo
Bhala inhloso ngaphambi kokuhlola: yikuphi ukuhamba okumele kusebenzise umhubhe, yikuphi okungaphuma ngqo, yiziphi imindeni yamakheli esemkhawulweni, nokuthi kumele kwenzeke ini lapho umhubhe uphansi. Ngaphandle kwaleyo mhlahlandlela yokuqala konke ukubona kuyadida, ngoba awukwazi ukuhlukanisa ukuvuza nomzila okuwuvumele ngamabomu.
Bese ubuza umbuzo owodwa ngesikhathi. Lo mkhuba uthatha iphi indlela. Lesi sibonisi sibika liphi ikheli. Isikhathi sakhetha liphi ipheya lombambimeli. Gcina izimpendulo eceleni komgomo futhi uzihambise nosuku, ngoba ukubuyekezwa kwe-firmware kungashintsha indlela yokuziphatha ezemukelwe ngayo kuthule kwenze isiphetho sonyaka odlule singasebenzi.
Urutha usewuphuzu lokusebenzisa oluqinile, ngoba ubona ukuhamba iklayenti elingakwazi ukukugwema ngaphandle kokuzilungisa kabusha. Lokhu akusona isithembiso sokuthi yonke insimu kuyo yonke iphrothokholi yohlelo ayembuli lutho, futhi akubambeli indawo yokubhala imizila oyikhethe ukuthi ivunyelwe.